@amalgm/channels 0.1.3 → 0.1.5-main.34175005481

package/PURPOSE.md

@@ -20,8 +20,34 @@ that no computer has accepted yet. Chat sessions, transcripts, and agent
 execution stay on the pinned user's computer. The hosted service is its own
 deployable and does not run inside or depend on Amalgm Gateway.
 
+Each hosted Channels environment reaches only its declared UI issuer and
+database. Main and preview initially share the database by owner direction;
+their public API and issuer identities remain distinct. Durable delivery leases
+remain authoritative when multiple hosts share data.
+
 ## Axioms
 
+Consumer assembly derives exact same-branch dependency pins from the declared
+package manifests and registry candidate records. One pending composition per
+branch preserves human edits; complete consumer checks for the exact merge tree govern its
+merge, and publication never implies installed adoption.
+
+Managed package delivery starts from a clean, exact main or preview source
+commit. The workflow occurrence supplies only its generated version and source
+record; tests run against those candidate inputs before packing. Every native
+gate and publication use that same tarball and integrity. A candidate tag makes
+bytes available to release assembly; it never promotes an installed runtime.
+Release tooling remains available inside each owner repository so a developer
+or CI job never needs access to another private product repository.
+Registry credentials are available only to the final protected publication job,
+after every native examination proves the exact candidate bytes.
+The repository token creates only its own dependency proposals and explicitly
+dispatches checks and delivery; every admitted gate proves the actual checkout,
+including the exact two-parent merge commit that becomes managed source.
+
+Managed releases bind to one exact published Core version and build from the
+locked dependency graph on the supported Node toolchain.
+
 1. Every user delivery and every accepted inbound message belongs to exactly
    one authenticated user.
 2. A public send input never contains a user id, email address, phone number,
@@ -67,6 +93,9 @@ deployable and does not run inside or depend on Amalgm Gateway.
     a sent delivery to delivered or failed.
 19. The global CLI projects the same command definitions as MCP and reaches
     hosted effects only through Shell's authenticated loopback MCP route.
+20. The host validates its complete Core binding and every configured endpoint
+    before composing clients or workers; an isolated local host uses only
+    explicitly supplied loopback authorities.
 
 ## Tree
 
@@ -85,3 +114,10 @@ host/                 Supabase, auth, provider, server, and Fly composition
 supabase/migrations/  durable schema and atomic RPCs
 skills/channels/      agent usage guidance
 ```
+
+Hosted delivery examines the final immutable image under both declared managed
+bindings before deploying that exact digest to its source branch's Fly app.
+The host's own pipeline owns replacement, health and provider verification;
+no hosted process updates its package tree in place. A local image examination
+proves image behavior, while Fly networking and durable product journeys retain
+their separate provider proof.

package/README.md

@@ -73,3 +73,37 @@ purpose and invariants.
 ```bash
 npm run verify
 ```
+
+## Managed package delivery
+
+Managed npm delivery uses `.github/workflows/publish-package.yml` after the
+exact main/preview owner checks pass. The occurrence generates a unique
+prerelease version and records its source SHA; it reruns the owner suite, packs
+once, and installs that tarball on Linux, macOS and Windows before publication.
+The `candidate-main`/`candidate-preview` tags are release-assembly inputs and
+never select installed runtimes. `package.json` declares this owner's gates,
+CLI probes, peer-only exports and lifecycle permissions. The standalone runner
+under `scripts/release/` is intentionally copied across owners to preserve
+private repository access boundaries. The final publish step uses the `NPM_TOKEN`
+secret in the `npm-release` environment. Where npm trusted publishing is
+configured for this repository's `publish-package.yml` and that environment,
+the token can be omitted. Authentication does not replace native certification,
+exact source records or artifact integrity; private source repositories do not
+receive npm's public-source provenance.
+
+Hosted delivery is separately wired in `release-hosted.yml`: it builds the exact
+source image, tests both declared bindings without network access, deploys the
+same digest to the selected Fly app, then verifies machine identity and public
+readiness. `package.json` owns the host declaration. The Python effect runner is
+an intentional standalone copy from UI; no other private repository is required.
+Live provider and durable product-flow proof remain separate release obligations.
+
+Managed dependency reconciliation reads this owner’s declared manifests and
+updates exact same-branch registry candidates in one pending composition PR per
+branch. The repository token explicitly dispatches the owner checks. Every declared gate must
+pass for the exact merge tree; an atomic expected-base update prevents merging
+with untested concurrent source. Human additions or amendments are preserved.
+The half-hour CI reconciliation recovers missed dispatch hints. Assembly runs
+no dependency code or lifecycle hooks, and repeated owner checks do not publish
+another candidate for unchanged source. Repository policy must allow GitHub Actions to create pull requests; no
+cross-repository credential or paid auto-merge feature is required.

package/dist/host/config.js

@@ -1,10 +1,14 @@
+import { isLoopbackEndpoint, resolveRuntimeEndpoint, validateRuntimeEndpointEnvironment } from '@amalgm/core/binding';
 export function channelsHostConfig(env = process.env) {
+    const publicOrigin = required(env.AMALGAM_PUBLIC_ORIGIN, 'AMALGAM_PUBLIC_ORIGIN');
+    const isolatedOrigin = isLoopbackEndpoint(publicOrigin) ? publicOrigin : undefined;
+    const binding = validateRuntimeEndpointEnvironment(env, isolatedOrigin);
     return Object.freeze({
         port: integer(env.PORT, 8080, 1, 65_535),
-        publicOrigin: httpsUrl(env.AMALGAM_PUBLIC_ORIGIN, 'AMALGAM_PUBLIC_ORIGIN'),
-        supabaseUrl: httpsUrl(env.SUPABASE_URL ?? env.NEXT_PUBLIC_SUPABASE_URL, 'SUPABASE_URL'),
+        publicOrigin: resolveRuntimeEndpoint(binding, 'channels', publicOrigin, isolatedOrigin),
+        supabaseUrl: resolveRuntimeEndpoint(binding, 'supabase', required(env.SUPABASE_URL ?? env.NEXT_PUBLIC_SUPABASE_URL, 'SUPABASE_URL'), isolatedOrigin),
         supabaseServiceRoleKey: required(env.SUPABASE_SERVICE_ROLE_KEY, 'SUPABASE_SERVICE_ROLE_KEY'),
-        authorizationIssuer: httpsUrl(env.AMALGM_AUTHORIZATION_ISSUER, 'AMALGM_AUTHORIZATION_ISSUER'),
+        authorizationIssuer: resolveRuntimeEndpoint(binding, 'app', required(env.AMALGM_AUTHORIZATION_ISSUER, 'AMALGM_AUTHORIZATION_ISSUER'), isolatedOrigin),
         resendApiKey: required(env.RESEND_API_KEY, 'RESEND_API_KEY'),
         resendWebhookSecret: required(env.RESEND_WEBHOOK_SECRET, 'RESEND_WEBHOOK_SECRET'),
         emailFrom: required(env.CHANNELS_EMAIL_FROM, 'CHANNELS_EMAIL_FROM'),
@@ -17,14 +21,6 @@ function required(value, name) {
         throw new Error(`${name} is required`);
     return value.trim();
 }
-function httpsUrl(value, name) {
-    const parsed = new URL(required(value, name));
-    const local = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';
-    if (parsed.protocol !== 'https:' && !(local && parsed.protocol === 'http:')) {
-        throw new Error(`${name} must use HTTPS`);
-    }
-    return parsed.toString().replace(/\/$/, '');
-}
 function integer(value, fallback, minimum, maximum) {
     const parsed = value === undefined ? fallback : Number(value);
     if (!Number.isInteger(parsed) || parsed < minimum || parsed > maximum) {

package/dist/host/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../host/config.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,kBAAkB,CAChC,MAAoD,OAAO,CAAC,GAAG;IAE/D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC;QACxC,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC;QAC1E,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,wBAAwB,EAAE,cAAc,CAAC;QACvF,sBAAsB,EAAE,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;QAC5F,mBAAmB,EAAE,QAAQ,CAAC,GAAG,CAAC,2BAA2B,EAAE,6BAA6B,CAAC;QAC7F,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC;QAC5D,mBAAmB,EAAE,QAAQ,CAAC,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC;QACjF,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QACnE,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;QACtE,iBAAiB,EAAE,QAAQ,CAAC,GAAG,CAAC,4BAA4B,EAAE,8BAA8B,CAAC;KAC9F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB,EAAE,IAAY;IACvD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB,EAAE,IAAY;IACvD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;IACjF,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,OAAO,CACd,KAAyB,EACzB,QAAgB,EAChB,OAAe,EACf,OAAe;IAEf,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,OAAO,IAAI,MAAM,GAAG,OAAO,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,OAAO,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../host/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,kCAAkC,EAAE,MAAM,sBAAsB,CAAC;AAetH,MAAM,UAAU,kBAAkB,CAChC,MAAoD,OAAO,CAAC,GAAG;IAE/D,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;IAClF,MAAM,cAAc,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,MAAM,OAAO,GAAG,kCAAkC,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC;QACxC,YAAY,EAAE,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,CAAC;QACvF,WAAW,EAAE,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,wBAAwB,EAAE,cAAc,CAAC,EAAE,cAAc,CAAC;QACpJ,sBAAsB,EAAE,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;QAC5F,mBAAmB,EAAE,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,2BAA2B,EAAE,6BAA6B,CAAC,EAAE,cAAc,CAAC;QACrJ,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC;QAC5D,mBAAmB,EAAE,QAAQ,CAAC,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC;QACjF,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;QACnE,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;QACtE,iBAAiB,EAAE,QAAQ,CAAC,GAAG,CAAC,4BAA4B,EAAE,8BAA8B,CAAC;KAC9F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB,EAAE,IAAY;IACvD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,OAAO,CACd,KAAyB,EACzB,QAAgB,EAChB,OAAe,EACf,OAAe;IAEf,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,OAAO,IAAI,MAAM,GAAG,OAAO,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,OAAO,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/channels",
-  "version": "0.1.3",
+  "version": "0.1.5-main.34175005481",
   "description": "Amalgm's SDK and hosted service for durable bidirectional user channels.",
   "type": "module",
   "license": "UNLICENSED",
@@ -46,13 +46,19 @@
     "test": "tsx --test test/*.test.ts",
     "verify": "npm run check && npm test && npm run build && tsx scripts/check-cli-artifact.ts",
     "prepack": "npm run build",
-    "start": "node dist/host/main.js"
+    "start": "node dist/host/main.js",
+    "release:admit": "node scripts/release/package.mjs admit",
+    "release:prepare": "node scripts/release/package.mjs prepare",
+    "release:examine": "node scripts/release/package.mjs examine",
+    "release:publish": "node scripts/release/package.mjs publish",
+    "release:compose": "node scripts/release/compose.mjs",
+    "test:release": "node --test scripts/release/*.test.mjs"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=24"
   },
   "dependencies": {
-    "@amalgm/core": "0.4.6",
+    "@amalgm/core": "0.4.7",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@supabase/supabase-js": "2.57.4",
     "jose": "^6.1.0",
@@ -62,5 +68,40 @@
     "@types/node": "^26.1.2",
     "tsx": "^4.23.1",
     "typescript": "5.9.3"
+  },
+  "amalgmRelease": {
+    "schema": 1,
+    "workflow": "verify.yml",
+    "jobs": [
+      "verify"
+    ],
+    "verify": "verify",
+    "cli": [
+      "amalgm-channels"
+    ]
+  },
+  "allowScripts": {
+    "esbuild@0.28.2": true,
+    "fsevents@2.3.3": false
+  },
+  "amalgmHosts": {
+    "channels": {
+      "directory": ".",
+      "context": ".",
+      "dockerfile": "Dockerfile"
+    }
+  },
+  "amalgmComposition": {
+    "schema": 1,
+    "manifests": [
+      "package.json"
+    ]
+  },
+  "gitHead": "789d2d7025a41b9d3911faff030e088fb01650d9",
+  "amalgmSource": {
+    "repository": "amalgm-inc/amalgm-channels",
+    "branch": "main",
+    "commit": "789d2d7025a41b9d3911faff030e088fb01650d9",
+    "occurrence": "34175005481"
   }
 }